CVE-2021-20404 Denial of service in Security Verify Information Queue
A remote attacker can cause a denial of service by sending an invalid cookie value, preventing future logins in IBM Security Verify Information Queue.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-20404?
CVE-2021-20404 is a low-severity denial of service vulnerability in IBM Security Verify Information Queue, published on 11 Feb 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user on the network to cause a denial of service due to an invalid cookie value that could prevent future logins. IBM X-Force ID: 196078.
Which versions are affected by CVE-2021-20404?
It affects 1 product.
Products include Ibm Security Verify Information Queue.
How do I fix CVE-2021-20404?
No fix has been published for CVE-2021-20404 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-20404 being exploited?
There is no known exploitation of CVE-2021-20404 in the wild and no public exploit code.
Other vulnerabilities in IBM Security Verify Information Queue
- CVE-2021-20411 Auth bypass in Security Verify Information Queue
- CVE-2021-20408 Information disclosure in Security Verify Information Queue
- CVE-2022-35287 Hardcoded credentials in Security Verify Information Queue
- CVE-2024-45669 IBM Security Verify Information Queue denial of service
- CVE-2022-35285 Cross-site request forgery in Security Verify Information Queue
Sources
Also known as GHSA-fjvw-vpv7-j2gp.